mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-26 10:51:36 -04:00
aeebe8d833
Triage of Greptile findings on the default-Zim / configurable-directory PR: - Stale config on restart (P1): settings update() only queues an async background_save, and the restart switch has no ordering guarantee (the switch worker pops LIFO), so start_kiwix_serve.sh could read the old zims_destination. Save the config synchronously before activating the restart switch. - YAML null (P1): read_config_value.sh now treats an unquoted null/~ as unset (returns the default), matching PyYAML/the Python config layer. A quoted "null" remains the literal string. - Path traversal (P1/security): the settings API now rejects a zims_destination containing "..", and start_kiwix_serve.sh defends in depth by falling back to `zims` for any absolute/traversal/empty value, so Kiwix can never scan or rewrite library.xml outside the media root. - Reproducible build (P2): pin the zim-tools image to 3.7.0 instead of :latest. Tests added for null handling, traversal rejection (API + script). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| build_app.sh | ||
| cleanup_orphaned_tags.py | ||
| delete_downloads.py | ||
| delete_similarly_named_videos.py | ||
| dev_build.sh | ||
| find_and_convert_srt_to_vtt.py | ||
| find_and_rename_orphan_video_files.py | ||
| find_corrupt_videos.py | ||
| fix_media_permissions.sh | ||
| generate_certificates.sh | ||
| generate_subtitles.py | ||
| install_debian_12.sh | ||
| install_help_service.sh | ||
| install_protomaps.sh | ||
| install_raspberrypios.sh | ||
| renew_certificates.sh | ||
| reset_api_db.sh | ||
| reset_tags.sh | ||
| reset_virtual_environments.sh | ||
| singlefile_browser_wrapper.sh | ||
| singlefile_to_archive.py | ||
| start_kiwix_serve.sh | ||
| upgrade.sh | ||
| upgrade_yt-dlp.sh | ||
| wrolpi-usb.sh | ||